by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Before installing or enabling this skill, ensure the governance scripts it references are available and have been audited. The package contains only documentation — it does not include the .ps1 scripts it tells you to run. If you plan to use it, either (a) obtain and review the scripts from a trusted source and store them in the workspace with restricted permissions, or (b) implement your own vetted scripts that follow the described policy. Limit the skill's workspace access (or run it in a sand...详细分析 ▾
ℹ 用途与能力
The skill's name and description (manage skill lifecycle, routing, core pool tuning) match the instructions which operate on a skill-registry.json and describe status transitions. However, the SKILL.md repeatedly references concrete scripts (PowerShell .ps1 files) that are not included in the package and there's no install spec — that is an inconsistency between claimed capabilities and the actual artifact delivered.
⚠ 指令范围
Runtime instructions instruct running scripts that read/write local workspace files (skill-registry.json and 'evidence'), and to perform status transitions and weekly cleanup. Because no scripts are provided, an operator or the agent would need to create, fetch, or run ad-hoc commands to implement these steps. The instructions permit broad read/write access to the workspace (which may contain secrets or unrelated data) and give operational authority over the central skill registry — reasonable for a governance tool but risky without concrete, auditable scripts.
✓ 安装机制
No install spec and no code files are present, so nothing will be written to disk by an installer. This reduces supply-chain risk, but it also means the declared scripts are missing and must be provided externally, which is the core concern.
✓ 凭证需求
The skill declares no required environment variables, credentials, or config paths. That is proportionate to the stated local governance purpose.
ℹ 持久化与权限
The skill is not marked always:true and allows normal autonomous invocation (default). It explicitly intends to modify skill-registry.json (the agent's source-of-truth for skills), which is expected for governance but is a powerful capability: whoever supplies or runs the missing scripts would be able to change which skills are eligible for automatic routing. That capability should be treated as high-impact and controlled.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/2
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install skill-governance-balanced
镜像加速npx clawhub@latest install skill-governance-balanced --registry https://cn.longxiaskill.com